Instant SECURE Full Stack Apps and AI Agents

Turn plain English into a working full-stack app — database, secure API, business logic, and frontend — running on your own hardware, with zero lock-in. An open-source alternative to Lovable, Bolt, and Replit that gives you the whole backend, plus an MCP server that turns every endpoint into a tool for Claude, Cursor, or Codex.

Run it in 60 seconds

curl -fsSL https://hyperlambda.dev/docker-compose.yaml | docker compose -f - up

Then open localhost:5555, point it at localhost:4444, and log in with root / root.

Point the API Wizard at your database, and it generates a complete, secured REST API — then extend it in plain English, without a build or deploy step.

⭐ If this saves you time, star the repo — it's the main way other developers find it.

What you can build

• Full-stack business apps — CRM systems, admin panels, booking systems, internal tools; database, secure API and frontend generated from natural language
• Database-driven AI agents — agents that query and update your database and invoke your endpoints, behind your own role-based access control
• AI chatbots and expert systems — crawl a website, get an embeddable chatbot grounded in your own content
• Secure APIs over legacy databases — point it at an existing MySQL, PostgreSQL, SQL Server or MariaDB schema and get a CRUD API in seconds
• Wrappers around third-party APIs — paste an OpenAPI or Swagger URL and get typed, documented endpoints wrapping Stripe, GitHub, Slack or anything else publishing a spec
• MCP tool servers — expose your endpoints to Claude, Cursor, Codex, Qoder or any MCP client
• Background jobs and automation — scheduled tasks written in Hyperlambda, or generated from a plain English description
• Static sites and SPAs — your cloudlet serves files directly, next to the APIs powering them

How it compares

The LLM that cannot hallucinate functions

Magic runs Hyperlambda, which can be generated by our own proprietary LLM. Because we generate an AST rather than text, the output is analysed and rejected if it contains functions that don't exist. The Hyperlambda Generator cannot return hallucinated function invocations — like any LLM it can still write logically wrong code, but every function it invokes is guaranteed to exist.

Combined with the ability to restrict the vocabulary, this lets you ship AI agents that grow their own tool space on demand, without widening your attack surface.

Unique security model

Hyperlambda runs sandboxed, with no file system access outside its sandbox, and can whitelist individual functions through its RBAC system — so your server can accept code as input and execute it safely without knowing where it came from. Restricting invocations at the execution level makes Hyperlambda, as far as we know, the only language that currently does this.

I'm so confident in the codebase quality, I'll give you $100 if you can find a severe security-related bug in its backend code — and another $100 if you can exploit the natural language API, which has accepted arbitrary public input for 3 months with nobody succeeding.

MCP support — and an 80% token saving

Install the mcp plugin, point Claude Code, Cowork, or OpenAI's Codex at your cloudlet, and every HTTP endpoint in your modules folder becomes a tool the agent can invoke. In our measurements this also cuts token consumption by roughly 80%. Calculate your own savings here.

Performance

In our measurements Hyperlambda is roughly 20× faster than FastAPI or Flask, around 50× faster than LangChain, and 100–1,000× faster than graphical workflow tools such as n8n, Zapier and Make — because it runs a real compiled runtime instead of interpreting logic out of JSON, XML or YAML. Hyperlambda solutions are broadly on par with C# and Entity Framework on both performance and scalability.

The dashboard

The sidebar is the whole platform: Hyper IDE for editing, running and replaying any file on the server, Playground for executing Hyperlambda without saving it first, SQL Studio for querying and designing databases, Endpoint Generator for turning tables into secured CRUD endpoints and importing third-party APIs from their OpenAPI specifications, plus users and roles, scheduled tasks, machine learning, and the plugin store.

Your cloudlet is also an AI agent. With the MCP plugin installed, the URL at the top hands any MCP-capable agent your endpoints as tools. The Chatbot Wizard goes the other way: give it a website, and it crawls the site, turns what it finds into training data, and hands you an embeddable chatbot grounded in your own content.

Once you save the code, you can test it — no deployment or publish step required.

Notice the prompt bar below the editor, where "the Machine Creates the Code". Describe what you want in plain English and the built-in generator writes it straight into the file you're editing. The same bar follows you into the Playground and SQL Studio, generating Hyperlambda, SQL, HTML, or whatever fits the file you have open.

Chat Ops

Ctrl+. anywhere in the dashboard opens Chat Ops: a conversation with your cloudlet that slides in over whatever screen you are on, and stays there while you navigate. Ask it to generate an endpoint from Hyper IDE and the file lands in the tree behind you — the conversation is still open when you turn round to look at it.

It talks to the default model, the developer-tools model, and it does not merely answer. It executes AI functions on your behalf: crawl a site, query a database, generate a CRUD API, scrape a URL, run a Hyperlambda snippet. Each invocation appears as a pill — amber while it runs, green when it succeeds, red when it throws — and clicking one opens the exact file and JSON arguments the model sent, so you can see what it actually did rather than trust a summary.

The whole loop is enforced server-side. A function the model tries to invoke that is not declared on the type is rejected before it executes, every function file carries its own auth.ticket.verify, and the invocation runs under your JWT — so Chat Ops can never do anything you could not do yourself from the dashboard.

Answers stream in as Markdown with syntax-highlighted code (Hyperlambda included), Mermaid diagrams render inline, and you can attach up to five files — either uploaded to the cloudlet for a function to work on, or handed to the model to read. Copy any code block, or the whole response, with one click.

Chat Ops appears only when an OpenAI API key is configured, and the key dialog is where you pick which model default runs.

Import any API

Point the Import API tab at any OpenAPI or Swagger URL — OpenAPI 3.x or Swagger 2.0, JSON or YAML — and Magic generates Hyperlambda endpoints wrapping whichever operations you tick. Query parameters and form fields become named, typed arguments carrying the specification's own types, defaults, enums and descriptions, and required ones get validators, so a missing argument is refused before the upstream API is ever contacted.

Because Magic publishes an endpoint's file comment as its MCP tool description and each argument's comment as that argument's description, an imported API arrives at your agent as a set of self-describing tools. Slack's chat.postMessage becomes fifteen individually typed, individually described arguments — not one of them written by hand.

The upstream credential is never written into the generated files. It is read from your configuration at the moment the endpoint is invoked, so the files stay safe to commit, and you declare which of your roles are allowed to invoke the wrapper.